Bourne Community Radio | Independent Local Radio Lincs.

Bourne Community Radio Confidentiality & Data Protection Policy Statement

Bourne Community Radio is required to process relevant personal data regarding its members, volunteers, partners, stakeholders, clients and customers as part of its operation and shall take all reasonable steps to do so in accordance with this Policy.

Bourne Community Radio has access to information concerning many groups and individuals and it is therefore imperative that the strictest confidentiality is maintained at all times.

Information belongs to the person or agency entrusting it to members of Bourne Community Radio. Any information passed on outside of Bourne Community Radio will only be given with the express permission of the person or body which supplied the information unless Bourne Community Radio is legally obliged to disclose it.

Responsibility

Bourne Community Radio has a responsibility to ensure all its members and volunteers are aware of Data Protection principles and the need for confidentiality, and that they are aware of specific guidelines that may be developed for specialised areas of work.

All members of Bourne Community Radio and volunteers are responsible for ensuring any information they hold or are party to, is handled in line with Bourne Community Radio policies and the General Data Protection Regulation (GDPR) and Data Protection Act 2018.

All personal records, whether on paper or on computer are covered by the GDPR and Data Protection Act 2018 and individuals and the organisation have criminal liability if they recklessly disclose personal information. A serious breach would be a disciplinary matter.

Care With Identification

It is accepted that most breaches of confidentiality are accidental rather than deliberate and it is important to remember never to break confidentiality regardless of how the information is received. It is important to recognise that descriptions of individual events and circumstances can lead to identification even when names have not been used.

Discussions

It is accepted that on certain occasions you may need to discuss an issue with other members, for example the Chair. If this occurs it must be made absolutely clear that all people concerned are bound by confidentiality and that confidential matters must not be discussed outside Bourne Community Radio.

Exceptional Circumstances

Bourne Community Radio realises that on rare occasions it may be necessary to breach the basic rules of confidentiality. For example, safeguarding situations concerning dangers to children, young people or other vulnerable people, may necessitate a breach of confidentiality. Where a member or volunteer feels that a matter is sufficiently serious s/he must report it to the Chair. The Chair will make a decision as appropriate in line with Bourne Community Radio policies and depending on the nature of the issue. It may also be necessary to consult with the Vice-Chair and/or Secretary of Bourne Community Radio Management Committee before a decision is made on the action to be taken.

Data Protection Controller

The Chair of Bourne Community Radio is the Data Controller and will endeavour to ensure that all personal data is processed by Bourne Community Radio’s Data Protection Officer (BCR’s Secretary) in compliance with this Policy and the Principles of the GDPR and Data Protection Act 2018. The Freedom of Information Act 2000 is also relevant to parts of this policy.

The Principles

Bourne Community Radio shall so far as is reasonably practicable comply with the Data Protection Principles (the Principles) contained in the GDPR and Data Protection Act 2018 to ensure all data is:

Fairly and lawfully processed
Processed for a lawful purpose
Adequate, relevant and not excessive
Accurate and up to date
Not kept for longer than necessary
Processed in accordance with the data subject's rights
Secure
Not transferred to other countries without adequate protection

Personal Data

Personal data covers both facts and opinions about an individual where that data identifies an individual. Personal data may also include sensitive personal data as defined in the Act.

Processing of Personal Data

Consent may be required for the processing of personal data unless processing is necessary for the performance of a contract of service. Any information which falls under the definition of personal data and is not otherwise exempt, will remain confidential and will only be disclosed to third parties with appropriate consent.

Bourne Community Radio processes some personal data for direct marketing and fund-raising purposes, data subjects have the right to request an opt-out to these activities, which must be respected.

Sensitive Personal Data

Bourne Community Radio may, from time to time, be required to process sensitive personal data. Sensitive personal data includes data relating to medical information, gender, religion, race, sexual orientation and criminal records and proceedings.

Rights of Access to Information

Data subjects (i.e. individuals who are the subject of the personal data) have the right of access to information held by Bourne Community Radio, subject to the provisions of the Data Protection Act 2018 and the Freedom of Information Act 2000. Any data subject wishing to access their personal data should put their request in writing to the Data Protection Officer. Bourne Community Radio will endeavour to respond to any such written requests as soon as is reasonably practicable and, in any event, within 40 days for access to records and 21 days to provide a reply to an access to information request. The information will be imparted to the data subject as soon as is reasonably possible after it has come to Bourne Community Radio's attention and in compliance with the relevant Acts.

Exemptions

Certain data is exempt from the provisions of the Data Protection Act which includes the following:

The assessment of any tax or duty
Where the processing is necessary to exercise a right or obligation conferred or imposed by law upon Bourne Community Radio, including Safeguarding and prevention of terrorism and radicalisation.

The above are examples only of some of the exemptions under the Act. Any further information on exemptions should be sought from the Data Controller.

Accuracy

Bourne Community Radio will endeavour to ensure that all personal data held in relation to all data subjects is accurate. Data subjects must notify the Data Processor of any changes to information held about them. Data subjects have the right in some circumstances to request that inaccurate information about them is erased. This does not apply in all cases, for example, where records of mistakes or corrections are kept, or records which must be kept in the interests of all parties to which they apply.

Enforcement

If an individual believes that Bourne Community Radio has not complied with this Policy or acted otherwise than in accordance with the Data Protection Act, the member of staff should utilise Bourne Community Radio’s grievance procedure and should also notify the Data Controller.

Data Security

Bourne Community Radio will take appropriate technical and organisational steps to ensure the security of personal data. All members will be made aware of this policy and their duties under the Act. Bourne Community Radio and all members are required to respect the personal data and privacy of others and must ensure that appropriate protection and security measures are taken against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to all personal data. Personal data must be stored in appropriate systems and an appropriate level of data security must be deployed for the type of data and the data processing being performed.

Other personal data may be for publication or limited publication within Bourne Community Radio, therefore having a lower requirement for data security. Attention is also drawn to the Company’s Security Policy and Email, Internet & Social Media Policy, which provide more specific information on digital data protection.

External Processors

Bourne Community Radio must ensure that data processed by external processors, for example, service providers, Cloud services including storage, web sites etc. are compliant with this policy and the relevant legislation.

Secure Destruction

When data held in accordance with this policy is destroyed, it must be destroyed securely in accordance with best practice at the time of destruction.

Retention of Data

Bourne Community Radio may retain data for differing periods of time for different purposes as required by statute or best practices.

Other statutory obligations, legal processes and enquiries may also necessitate the retention of certain data. Bourne Community Radio may store some data such as registers, photographs, books and works including music scores etc. indefinitely in its archive.

17.22 Bourne Community Radio Privacy Notice for Members

This document provides a widely drafted privacy notice to allow data to be processed under a number of grounds and for a number of purposes.

Privacy Notice

How your information will be used

Bourne Community Radio needs to keep and process information about you for normal purposes. The information we hold and process will be used for our management and administrative use only and will be processed by authorised personnel only and confidentially stored. We will keep and use it to enable us to run the organisation and manage our relationship with you effectively, lawfully and appropriately, during the member recruitment process, whilst you are a member, at the time when you leave and after you have left. This includes using information to enable us to comply with any legal requirements, pursue the legitimate interests of the organisation and protect our legal position in the event of legal proceedings. If you do not provide this data, we may be unable in some circumstances to comply with our obligations and we will tell you about the implications of that decision.
As a local, independent community radio station broadcasting the best in music, entertainment and community updates, Bourne Community Radio may sometimes need to process your data to pursue our legitimate business interests. For example, to prevent fraud, administrative purposes or reporting potential crimes. The nature of our legitimate interests are to contact members in case of emergency; maintaining records of training provision; and maintaining data in relation to safeguarding children, young people & vulnerable adults for the purposes of the organisation. We will never process your data where these interests are overridden by your own interests.
Much of the information we hold will have been provided by you, but some may come from other internal sources, or in some cases, external sources, such as referees.
The sort of information we hold includes your application form and references; correspondence with or about you; contact and emergency contact details;; information needed for equal opportunities monitoring policy; information needed for disclosure and barring certificates and/or the DBS Update Service; and, where appropriate, disciplinary and grievance records.
Where necessary, we may keep information relating to your health, which could include allergies. This information will be used in order to comply with our health and safety and occupational health obligations – to consider how your health affects your ability to volunteer and whether any adjustments to support your volunteering might be appropriate.
Where we process special categories of information relating to your racial or ethnic origin, religious and philosophical beliefs or sexual orientation, we will always obtain your explicit consent to those activities unless this is not required by law or the information is required to protect your health in an emergency. Where we are processing data based on your consent, you have the right to withdraw that consent at any time.
Other than as mentioned below, we will only disclose information about you to third parties if we are legally obliged to do so.
We may transfer information about you to other group companies for purpose connected with the management of Bourne Community Radio’s business.
The criteria used for determining how long your data will be stored for is:
Application forms and interview notes (for unsuccessful volunteering candidates) – six months
Personnel files and training records (including disciplinary records and volunteering time records) - 6 years after volunteering ceases.
Management Committee records - permanently for historical purposes.
If in the future we intend to process your personal data for a purpose other than that which it was collected we will provide you with information on that purpose and any other relevant information.

Your rights

Under the General Data Protection Regulation (GDPR) and The Data Protection Act 2018 (DPA) you have a number of rights with regard to your personal data. You have the right to request from us access to and rectification or erasure of your personal data, the right to restrict processing, object to processing, as well as in certain circumstances, the right to data portability.
If you have provided consent for the processing of your data you have the right (in certain circumstances) to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn.
You have the right to lodge a complaint to the Information Commissioners’ Office if you believe that we have not complied with the requirements of the GDPR or DPA 2018 with regard to your personal data. Identity and contact details of Data Controller and Data Protection Officer.
Bourne Community Radio is the controller and processor of data for the purposes of the GDPR and DPA 2018.
If you have any concerns as to how your data is processed you can contact:

Adrian Smith - Data Controller
Shelley Spink - Data Protection Officer

Updated 27th January 2026